No description
Find a file
Magnus Karlsson 5959319123 xsk: Fix xsk_diag use-after-free error during socket cleanup
[ Upstream commit 3e019d8a05 ]

Fix a use-after-free error that is possible if the xsk_diag interface
is used after the socket has been unbound from the device. This can
happen either due to the socket being closed or the device
disappearing. In the early days of AF_XDP, the way we tested that a
socket was not bound to a device was to simply check if the netdevice
pointer in the xsk socket structure was NULL. Later, a better system
was introduced by having an explicit state variable in the xsk socket
struct. For example, the state of a socket that is on the way to being
closed and has been unbound from the device is XSK_UNBOUND.

The commit in the Fixes tag below deleted the old way of signalling
that a socket is unbound, setting dev to NULL. This in the belief that
all code using the old way had been exterminated. That was
unfortunately not true as the xsk diagnostics code was still using the
old way and thus does not work as intended when a socket is going
down. Fix this by introducing a test against the state variable. If
the socket is in the state XSK_UNBOUND, simply abort the diagnostic's
netlink operation.

Fixes: 18b1ab7aa7 ("xsk: Fix race at socket teardown")
Reported-by: syzbot+822d1359297e2694f873@syzkaller.appspotmail.com
Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: syzbot+822d1359297e2694f873@syzkaller.appspotmail.com
Tested-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Link: https://lore.kernel.org/bpf/20230831100119.17408-1-magnus.karlsson@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-09-19 12:30:16 +02:00
arch x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm() 2023-09-19 12:30:14 +02:00
block blk-throttle: consider 'carryover_ios/bytes' in throtl_trim_slice() 2023-09-19 12:30:16 +02:00
certs
crypto crypto: af_alg - Decrement struct key.usage in alg_set_by_key_serial() 2023-09-13 09:53:55 +02:00
Documentation dt-bindings: clock: xlnx,versal-clk: drop select:false 2023-09-19 12:30:11 +02:00
drivers drm/i915: mark requests for GuC virtual engines to avoid use-after-free 2023-09-19 12:30:16 +02:00
fs smb: propagate error code of extract_sharename() 2023-09-19 12:30:16 +02:00
include net: fib: avoid warn splat in flow dissector 2023-09-19 12:30:16 +02:00
init
io_uring io_uring: Don't set affinity on a dying sqpoll thread 2023-09-13 09:53:52 +02:00
ipc
kernel netfilter: nf_tables: Audit log rule reset 2023-09-19 12:30:16 +02:00
lib lib/test_meminit: allocate pages up to order MAX_ORDER 2023-09-19 12:30:11 +02:00
LICENSES
mm Multi-gen LRU: avoid race in inc_min_seq() 2023-09-19 12:30:11 +02:00
net xsk: Fix xsk_diag use-after-free error during socket cleanup 2023-09-19 12:30:16 +02:00
rust
samples
scripts kconfig: fix possible buffer overflow 2023-09-19 12:30:13 +02:00
security
sound ASoC: tegra: Fix SFC conversion for few rates 2023-09-19 12:30:10 +02:00
tools selftests/bpf: Fix flaky cgroup_iter_sleepable subtest 2023-09-19 12:30:15 +02:00
usr
virt kvm/vfio: ensure kvg instance stays around in kvm_vfio_group_add() 2023-09-13 09:53:29 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
.rustfmt.toml
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile kbuild: do not run depmod for 'make modules_sign' 2023-09-19 12:30:12 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.